Vodafone Secure Device Manager - Ready? The future is exciting - Vodafone NZ
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Vodafone Secure
Device Manager
The future is exciting.
Ready?
My Vodafone
Administrator User Guide
Contents
Introduction 3
Requirements
Help 4
• If you would like to enrol Apple devices you will need an Apple APN
How to find help in the Vodafone Secure Device Manager console 4 certificate, or Apple ID.
Mobile Device Management structure 5 • Internet access – supported browsers include:
Creating organisation groups 6 – Chrome
– Firefox
Generating an APNs certificate 7 – Safari
Why do you need an Apple APNs certificate? 7 – Internet Explorer 11
– Microsoft Edge
Renewing an APNs certificate 8
Android Enterprise 9 If you have any questions, your first port of call is the Help section
Why do you need Android Enterprise 9 on page 4 of this user guide. For all other queries contact your Account
Manager or call 888 from your mobile.
Android Enterprise modes 10
Creating an administrator account 11
Creating user accounts 12
Configuring and deploying profiles 13
1. Password 14
2. Email 15
3. Exchange 16
Application installation 17
Enrolling devices 18
Enrolling corporate owned devices 18
The enrolment process 18
Vodafone Secure Device Manager hub 19
Dashboard 20
Basic admin operations 20
Reporting 21
Creating report subscriptions 21
Glossary of terms 22
Vodafone Secure Device Manager Administration User Guide — Page 2
Introduction
Mobile devices are very handy business tools. They allow employees to
access your internal content and resources from wherever they are working.
However, the diversity of mobile platforms, operating systems and versions
can make managing a set of devices a challenge. Vodafone Secure Device
Manager (VSDM) solves this problem by enabling you to configure, secure,
monitor, and manage all types of mobile devices within your organisation.
The VSDM console lets you view and manage every aspect of your Mobile
Device Management (MDM) deployment. With this single, web-based
resource, you can quickly and easily add new devices and users to your fleet,
manage profiles and configure system settings.
We recommend you familiarise yourself with security settings and interface
features such as the Getting Started Wizard, menu icons, and global search.
VSDM provides a smart solution to security concerns and accessibility
inherent to business mobility. Here's a few things it allows you to do:
• Manage large-scale deployments of mobile devices from
a single console.
• Enrol devices in your business environment quickly and easily.
• Configure and update device settings remotely.
• Enforce security and compliance policies.
• Secure mobile access to corporate resources.
• Remotely lock and wipe managed devices.
Vodafone Secure Device Manager Administration User Guide — Page 3
Help
You have three options for admin support and assistance for VSDM: Click this to open up the online guides where you can search for a topic,
or view the various administration guides.
1.
Administrator training: The three hours of admin training is
important to help you understand the basics of how to administer
VSDM. This'll help you take advantage of the extensive range of
features and benefits.
2.
VSDM Online Help: Once you’ve completed the training, the online
Help should be your first port of call for any queries on VSDM. There are
a number of guides available here to help you understand the features
within the product, as well as more detailed information if you want to
integrate more of your services with VSDM.
Help is broken down into relevant sections so you can find what you
need, and there’s a search function so you can quickly find your answer.
3.
Call us: If you can’t find the answer you’re looking for online,
call 888 from your mobile or 0800 400 888 from your landline.
How to find Help in the VSDM console
In the upper right hand corner of the console there is a Help link.
Vodafone Secure Device Manager Administration User Guide — Page 4
Mobile Device Management structure
The VSDM console lets you create a structure to meet the needs of your APNs
business. If you decide to have a different set of policies to manage different Customer
Root Level
Administrator account
parts of your organisation, the console can support this too. Below are some
examples of how you might choose to create your structure within VSDM. Profile C Production Profiles
Production Profiles at this level will apply Help desk
Organisation Groups can accommodate functional, geographic, to the entire production group administrator
and organisational entities and enable a multi-tenancy solution.
• Scalability – flexible support for exponential growth. BYO
Multi-tenancy – create groups that function as independent
•
environments.
Corp Owned
• Inheritance – streamline the setup process by setting child groups
to inherit parent configurations.
Finance
Profile C Department Profiles
HR Profiles at this level will apply
to this container
Exec Team
Profile C Test Profiles
Test Any profiles created here can be contained in a text
environment before being put into production
Administrator User
Vodafone Secure Device Manager Administration User Guide — Page 5
Creating organisation groups
The hierarchy of your structure determines which Organisation Groups are
children and which are parents. However, you need to add repositories and
applications before you can choose to override this native inheritance.
As well as adding repositories and applications to child groups that inherit
parent group settings, you may also override inheritance at each group
level if you choose.
You need to create an Organisation Group (OG) for each business entity
where devices are deployed. Be aware that the OG you are currently in is
the parent of the child OG you are about to create. Follow these steps: NEW IMAGE
1. Select Group & Settings > Groups. TO BE SUPPLIED
2. Click the Organisation Group.
3. Navigate to Organisation Group Details.
4.
Under Add Child Organisation Group, fill in the fields and press
Save to create the group.
Vodafone Secure Device Manager Administration User Guide — Page 6
Generating an APNs certificate
In order to manage iOS devices, administrators of iOS devices must generate Summary of steps:
and upload an Apple Push Notification service (APNs) certificate. VSDM helps
iOS admins complete this process quickly in a few simple steps. Generate MDM certificate in VSDM console.
What is an APNs Certificate?
This allows VSDM to communicate securely to Apple devices and report
information back to VSDM. As Per Apple's Enterprise Developer Program,
an APNs certificate is valid for one year and then must be renewed. The
VSDM console sends reminders through Notifications as the expiration
date nears. Your current certificate is revoked when you renew from the
Apple Development Portal, which prevents device management until you
upload the new one. W e recommend you plan to upload your certificate
immediately after it is renewed.
Why do you need an Apple APNs certificate?
Apple requires each organisation to maintain their own certificate to ensure
a secure mechanism for their team's devices to communicate across Apple’s
push notification messaging network.
How to generate an APNs certificate
1. Select Group and Settings > All Settings.
2. Navigate to Device & Users > Apple.
3. Select APNs For MDM.
4. Click Generate New Certificate (If option is not visible then select Override).
5. Download the MDM_APNRequest.plist file. This file will be required
to generate the certificate from Apple Portal. Go to Apple site by clicking
the button Go To Apple.
6. Login on the Apple site to generate the certificate.
7. After logging in, the home screen will appear. Click the Create a
Certificate button on the top right corner of the page.
8. Accept the License Agreement and click Next. Click Browse and upload
your MDM_APNRequest.plist file (downloaded in previous steps).
9. After uploading MDM_APNRequest.plist file, the Certificate will
be generated on the Apple site. Download the certificate to upload on
VSDM console.
10. Upload this certificate on the VSDM Console with Apple ID (which you
used while logged in on Apple) and click Save.
11. Enter the security PIN and your certificate will be uploaded on
VSDM Console.
12. After saving, the configuration will look like the image at the top right.
Vodafone Secure Device Manager Administration User Guide — Page 7
Generating an APNs certificate continued
Renewing an APNs certificate This is the relationship between VSDM, Apple and your team's iOS devices.
The APNs certificate expires annually and so must be renewed every year.
Renewing your certificates will ensure you are able to communicate with
and manage your iOS devices. Here's how you renew a certificate:
1. Return to the APNs for MDM page by navigating to Devices > Settings
> Device & Users > Apple > APNs for MDM.
2. Select the Renew option and right-click the .plist file to download the
file to an accessible location.
3. Select the Go to Apple button and sign into the Apple Push Certificates
Portal using the same Apple ID used to obtain the original signed
certificate. Using an alternate Apple ID will not allow you to renew the
proper certificate.
4. Select the Renew button corresponding to the certificate that is due
to expire and upload the .plist file downloaded in step 2.
5. Click Download on the confirmation page and save the regenerated
.pem file.
6. Return to the APNs for MDM page in the AirWatch Admin Console,
upload the regenerated .pem file and enter the same Apple ID used
to generate the certificate. Click Next and save the settings on the
APNs for MDM page.
Note: When generating or renewing at a top-level Organisation Group,
set child groups to inherit or override settings. If you receive the error
message "No APNs found at this location," ensure that your current
Organisation Group is inheriting the APNs certificate from the top-level
Organisation Group.
Vodafone Secure Device Manager Administration User Guide — Page 8
Android Enterprise setup
What is Android Enterprise?
Android Enterprise ensures proper use of Android devices and protection
of sensitive data. Profiles serve many different purposes, from letting
you enforce corporate rules and procedures to tailoring and preparing
Android Enterprise capable devices for how they are used.
Why do you need Android Enterprise?
Google is making Android more secure for enterprises by providing data
separation and security through a program called Android for Work.
Android Enterprise not only improves Bring You Own Device (BYOD)
programs but also allows enterprises to deploy corporate owned devices
that are enterprise ready.
The benefits of Android Enterprise include:
• Removes the fragmentation of manageability on Android devices, which
standardises the core components of Android on the same operating
systems across all devices regardless of manufacturer.
• Integrates the use of Google applications for business purposes
to provide personal and work profiles in a single, unified launcher.
• From Android Q traditional Device Administrator functionality will
be depreciated.
Setting up Android Enterprise
To start Android Enterprise setup in the AirWatch Console, do the following:
1. Navigate to Devices >Devices Settings> Devices & Users > Android
> Android for Work.
2. Select Configure. You will be redirected to the Android Enterprise
Google sign in page.
3. Select Get Started if you are already signed in with your Google
credentials. If you are not signed in, select Sign In to enter your Google
credentials and then select Get Started.
4. Enter your Organisation Name. The Enterprise Mobility Manager (EMM)
provider field will populate as AirWatch.
5. Select Confirm > Complete Registration. You will be redirected back
to the AirWatch Console, and your Google Service Account credentials
will automatically populate.
6. Select Save > Test Connection to ensure the service account is set up
and connected successfully.
Vodafone Secure Device Manager Administration User Guide — Page 9
Android Enterprise setup continued
Android Enterprise modes
Android Enterprise makes both profile-based and whole device management There are a handful of system apps that come with the Work Profile by
profiles available to integrate with VSDM when running on an Android default such as Work Chrome, Google Play, Google settings, Contacts and
Enterprise device. Android Enterprise does not use OEM-specific APIs, so Camera – these can be hidden using a restrictions profile.
all devices can take advantage of the same features. Devices can still use
Certain settings will also show the separation between personal and
OEM-specific APIs but that functionality does not work with Android for Work.
work configurations. Users will see separate configurations for the
Work Profile vs. Work Managed Device Mode following settings:
A Work Profile is a special type of administrator. The user already has
Credentials – View corporate certificates for user authentication to
•
a personal device with their own account, and VSDM manages the
managed devices.
Work Profile. VSDM enrollment will add a Work Profile and install the
AirWatch Agent inside the Work Profile as the profile owner for that user. • Accounts – View the Managed Google Account tied to the Work Profile.
The Work Managed device applies to devices that start in the unprovisioned • Applications – Lists all applications installed on the device.
state, and enrollment installs the AirWatch Agent the Work Managed device.
The AirWatch Agent will have full control of the entire device. Some profiles • Security – Shows device encryption status.
will display the following tags: Work Profile and Work Managed Device. Most Work Managed Device Mode Functionality
profiles, unless noted otherwise, will apply towards the Work Profile. When devices are enrolled in Work Managed Device mode, a true corporate
Profiles configured for the Work Profile only apply to the Android Enterprise ownership mode is created. AirWatch controls the entire device and there is
badged apps and not affect the users personal apps or settings unless you no separation of work and personal data.
configure profiles at the device level. For example, certain restrictions disable Important things to note for the Work Managed mode are:
access to YouTube, Google Play, etc. These will only affect the Android
Enterprise badged apps and not the regular Play Store versions. Alternatively, • The homescreen will not show badged app like Work Profile mode.
profiles configured for Work Managed Device mode type will apply to the • Users will only have access to a number of pre-loaded apps upon
entire device. Each profile discussed in this section will indicate which device activation of the device. Additional applications can only be approved
type the profile will affect. and added through the AirWatch Console.
Work Profile Mode Functionality • The AirWatch Agent is set as the device administrator in the security
Work Profile mode apps are differentiated by an red briefcase icon, referred settings and cannot be disabled.
to as badged apps, and are shown in a unified launcher with the user's
personal apps. For example, your device will show both a personal icon for
Google Chrome and a separate icon for Work Chrome denoted by the badge.
From an end user perspective, it looks like two different applications, but
the app is only installed once with business data stored separately from
personal data.
All Android Enterprise apps will display in the homescreen and the launcher
as a badged app so as to not interfere with the user's personal apps or
information.
The AirWatch Agent is badged and exists only within the Work Profile data
space. There is no control over personal apps nor will the Agent have access
to personal information.
Vodafone Secure Device Manager Administration User Guide — Page 10Creating an administrator account
When you sign up for VSDM, you'll be given an admin account to use.
You may wish to create additional administrator accounts for other people
who will also be managing the VSDM console. You can also define specific
admin roles for your team.
1. SelectAccounts > Administrators > List View and select Add User.
2. Fill in all required fields on the Basic tab. Continue to the Roles tab,
select Organisation Group followed by the Role you want to assign
to the new admin. Add as many roles as you want to assign to the admin
by using the Add Role button.
3. Choose Save to create the new admin account with every assigned role.
Vodafone Secure Device Manager Administration User Guide — Page 11Creating user accounts
A user account is required before you can enrol a device. This is the process
to follow to create end user accounts within the VSDM console.
For other methods such as importing users from your Active Directory,
or doing a bulk upload, please refer to the VSDM online help.
1. Navigate to Accounts > Users > List View.
2. Select Add User from the Add menu.
3. Fill in required fields and choose Save.
Vodafone Secure Device Manager Administration User Guide — Page 12Configuring and deploying profiles
Device Profiles are the primary means by which you can manage devices.
They represent the settings that, when combined with compliance policies,
help you enforce corporate rules and procedures.
You need to create profiles for each platform type then configure a payload,
which comprise the individual settings you configure for each platform type.
Profile can be also be used to support your mobile security policies by
enforcing restrictions on a device. A profile may also be used to assist with
your IT deployment by configuring services on a device.
1. Navigate to Menu > Profiles & Policies > Profiles, select Add and
choose the appropriate platform.
Note: If deploying for Android after clicking the Android icon select the
Android for Work option.
2. Configure General deployment settings. While configuring General
deployment settings, consider:
• Intended Recipients – by Assigned Organisation Group or User Group.
• Intended Devices – by make, model, OS and Ownership type.
• Delivery Model – by automatic or optional assignment type.
• Permissions – to allow or disallow removal.
• Access Constraints – by Geo-fence Area or Time Schedule.
3. Select and configure the profile payload. Each payload contains unique
settings and options depending on make, model and OS of the device
you're configuring.
4. Choose Save or Save & Deploy. Selecting Save keeps the newly
created profile in the list of available Profiles. Choosing Save & Deploy
adds the profile to the list of Profiles as well as pushing the profile to
all devices within the target Organisation Group.
After you have created and assigned profiles, you will need a way to manage
these settings one at a time and remotely from a single source.
1. Navigate to Devices > List View. Then select the device on which you
want to install the profile.
2. Navigate to Profiles and select the profile. After you select the profile,
the Install button should be visible. Click Install. The profile will
be applied on the device automatically. After successful installation,
a green icon will be visible for that profile on the console.
Vodafone Secure Device Manager Administration User Guide — Page 13Configuring and deploying profiles continued
Password
VSDM can be used to help you manage and configure passwords on devices.
By managing the password you can help ensure the security of the data
on the devices.
Requirements around password protection may vary depending on
your organisation's policies.
Here's how you create a password profile:
1. Navigate to Devices > Profiles > Add > Add Profile.
2. Select the appropriate platform for the profile you want to deploy.
Depending on the platform you select, the payload settings will vary.
3. Complete the General tab fields by completing the Name and
Assigned Groups sections.
4. Select the passcode payload.
5. Configure the passcode policy as per your requirement then save
and publish the profile.
Vodafone Secure Device Manager Administration User Guide — Page 14Configuring and deploying profiles continued
Email
You can use VSDM to help manage and configure email to your team's
devices. By managing email via VSDM, administrators have the ability to
control access to your organisation's email by removing the email profile.
Requirements around email set up may vary depending on the devices
in your organisation.
Here's how you create an Email profile:
1. Navigate to Devices > Profiles > Add > Add Profile.
2. Select the appropriate platform for the profile you want to deploy.
Depending on the platform you select, the payload settings vary.
3. Complete the General tab fields by completing the Name and
Assigned Groups sections.
4. Select Email Settings.
5. Configure the Server details then click the Save & Publish button.
Vodafone Secure Device Manager Administration User Guide — Page 15Configuring and deploying profiles continued
Exchange
VSDM can be used to help you manage and configure Exchange to the
devices. By managing email via VSDM, admins are able to control access
to your corporate email by removing the email profile.
Requirements around email set up may vary depending on the devices
in your organisation.
Here's how to create an Exchange profile:
1. Navigate to Devices > Profiles > Add > Add Profile.
2. Select the appropriate platform for the profile you want to deploy.
Depending on the platform you select, the payload settings vary.
3. Complete the General tab fields by completing the Name and
Assigned Groups sections.
4. Navigate to Exchange ActiveSync.
5. Enter the Mail Client and Server details then click the
Save & Publish button.
Vodafone Secure Device Manager Administration User Guide — Page 16Application installation
You can install or uninstall any public or internal app on a device from the
VSDM Console. Admins can manage these apps on the devices remotely.
Here's how to configure an app on the Console:
1. To add an application, navigate to Apps & Books > List View > Public
(select the option according to your App) > Add Application.
2. Select the platform and search the application from web.
3. Select the appropriate app.
4. In the Assignment tab, select the deployment method and Assignment
group as per your requirement then save and publish the app. The app
will then be saved on the console.
5. To install on a device, navigate to Devices > List View. Select any device
on which you want to install the application.
6. Navigate to Apps and select the app. Click Install. The app will
be applied on the device automatically. After successful installation
on the device, the green icon will be visible for that app on console.
Vodafone Secure Device Manager Administration User Guide — Page 17Enrolling devices
In order to manage devices via VSDM, a device first needs to be enrolled. The enrolment process
Enrolling a device allows you to associate and authenticate the device This process may differ slightly depending on the device platform. You can
against a user in the VSDM console. find specific instructions for enrolling each type of device in the applicable
In order to enroll a device, the end user will need the following information: Platform Guides under the Help menu of the VSDM console.
Enrolment URL − this brings you to the enrolment screen.
• You can look at the different enrolment options and how they affect device
This is specific to your organisation's enrolment environment enrolment in the Enrolment Processes Guide within Help.
(e.g. mdm-ds.vodafone.co.nz). Note: As a prerequisite, it is recommended that the AirWatch agent is
Group ID − this determines what MDM resources and features the
• installed on the device.
end-user will have access to upon enrolment. The AirWatch agent is necessary to establish communication with the
User Credentials − this username and password confirm the identity
• VSDM console.
of a user to allow login, authentication and enrolment. The credentials 1. Navigate to AWAgent.com from the native browser on the device that
may be the same as the network directory services credentials, or may you are enrolling.
be VSDM-specific credentials.
AirWatch auto-detects if the AirWatch Agent is already installed and
The VSDM console will allow you to send an enrolment message to end redirects to the appropriate mobile app store to download the Agent
users with this information to assist with enrolment. if needed.
Enrolling corporate owned devices Note: Downloading the Agent from public application stores requires
either an Apple ID or a Google Account.
If you are enrolling corporate owned devices you may want to consider
alternative methods of enrollment: 2. Launch the AirWatch Agent upon download completion or return to your
browser session to continue enrolment.
iOS Apple's Device Enrollment Program allows for out of the box
enrollment in to VSDM and greater ability to configure the device. 3. Enter your email address. AirWatch checks if your address has been
previously added to the environment in which case you are already
Android Work Managed Device Mode allows VSDM to manage a much
configured as an end user and your Organisation Group is already
larger set device settings.
assigned. If AirWatch cannot identify you as a previously configured
More information on both enrollment methods can be found through end user based on your email address, enter your Environment URL,
the VSDM console help pages. Group ID and Credentials when prompted.
4. Follow all remaining prompts to finalise enrolment.
Note: Each platform has slight variations in this process, so refer to each
specific Platform Guide in the VSDM Help section for more information.
Vodafone Secure Device Manager Administration User Guide — Page 18Vodafone Secure Device Manager hub
The VSDM Hub is a new feature of the platform and can provide you with
a snapshot view of your devices.
Click on one of the various graphs that display on the VSDM Hub to bring
up a Device List View that is automatically filtered for whichever segment
you selected. Send message actions can now be performed directly from
the Device List View. In addition, a new Export to PDF option lets you quickly
generate an at-a-glance report of your mobile device deployment for
reporting purposes.
Getting Started
Ensure that all aspects of a basic successful deployment are established.
Getting Started is organised to reflect only those modules within an VSDM
Console deployment that you are interested in. This produces an on boarding
experience that is more tailored to the actual configuration.
Hub
View and manage MDM information that drives decisions you must make
and access a quick overview of your device fleet. View specific information
such as the most blacklisted apps that violate compliance. Keep track of
module licenses with the Admin Panel Dashboard and monitor all devices
that are currently out of compliance.
Devices
Access an overview of common aspects of devices in your fleet, including
compliance status, ownership type breakdown, last seen, platform type, and
enrolment type. Swap views according to your own preferences including
full Dashboard, list view, and detail view. Access additional tabs, including all
profiles, enrolment status, Notification, Wipe Protection settings, compliance
policies, certificates, product provisioning, and printer management.
Accounts
Survey and manage users and administrators involved with your MDM
deployment. Access and manage user groups, roles, batch status and
settings associated with your users. Also, access and manage admin groups,
roles, system activity, and settings associated with your administrators.
Vodafone Secure Device Manager Administration User Guide — Page 19Dashboard Basic admin operations
The Device Dashboard displays updated data for compromised devices, You can manage team devices and perform functions on a particular set
pass code status, and device encryption. of devices using different screens in the VSDM console. There are some
basic operations which can done by administrators like Lock, Wipe, Send
notification and more.
• Navigate to Devices > List View > Select any device.
You will see basic functionality like Lock, Send notification, and Query
and More Actions options. Select any operation you need to perform.
More Actions can be found on the device detail page on the console.
Vodafone Secure Device Manager Administration User Guide — Page 20Reporting
Subscribing to reports will give you a regular update on the status
of your mobile devices.
To access the Reports page, navigate to Hub > Reports & Analytics
> Reports > List View. From here, there are several key pieces of
functionality that admins can use to leverage VSDM reporting capabilities:
Creating report subscriptions
These can be used to send custom generated reports to specific recipients
at a scheduled occurrence. To subscribe to a report:
1. Navigate to the Reports page at Hub > Reports & Analytics > Reports
> List View.
2. Select a pre-defined report template from the list and then from
the Actions icon on the right click the Subscribe button.
3. Complete the Report Subscriptions Form with all required information.
General Information – the name of the subscription, the email
•
subject, etc.
Report Parameters – the parameters defining the scope and
•
options of the report.
Distribution List – the recipients who will receive the custom report
•
whenever the subscription is executed.
Execution Schedule – the time and schedule at which the custom
•
report is generated.
4. Select Save.
Vodafone Secure Device Manager Administration User Guide — Page 21Glossary of terms Term / Abbreviation Description AD Active Directory Android Enterprise Previously called Android for Work, is the new way to configure Android devices APNs Apple Push Notification service AW AirWatch Console The web based system through which devices are managed DEP Device Enrollment Program offered by Apple Device Any mobile or fixed hardware that connects to a wireless network, including personal computers, mobile computers, mobile RF scanners, printers Enrolment url The URL needed to enroll a device in the VSDM Basic console EULA End user Licence Agreement GPS Global Positioning System HTTP Hypertext Transfer Protocol HTTPS Hypertext Transfer Protocol Secure IM Instant Messaging IMAP4 Internet Message Access Protocol 4 iOS Apple Operating System IP Internet Protocol OG Organisation Group OS Operating System POP3 Post Office Protocol 3 Profile A group of device configuration settings that are configured in the console and delivered to the device Role Defines the access role of a VSDM user including the ability to restrict or grant access to specific functionality within the console SIM Subscriber Identity Module SME Small Medium enterprise SMS Short Message Service SMTP Single Mail Transfer Protocol URL Uniform Resource Locator VPP Volume Purchase Program VSDM Vodafone Secure Device Manager Wi-Fi Wireless Fidelity Vodafone New Zealand Limited. Correct as of March 2018. Vodafone Secure Device Manager Administration User Guide — Page 22
You can also read
